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Art Unit: 4121 

DETAILED ACTION 

This is the first Office action in response to Application 10/773,649 filed on 
February 6, 2004. Claims 1-50 have been examined and are pending. 

Claim Objections 
1. Claim 19 is objected to because of the following informalities: 
"receiving an real-line analysis" should read "receiving a real-line analysis." 
Appropriate correction is required. 

Claim Rejections - 35 USC §101 

1. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

2. Claims 11-20, 31-40 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 

Claims 11, 15, 19, 31-32, 34-40 recite "a computer readable medium." 
The computer readable is not limited to statutory subject matter. In view of 
Applicant's disclosure as submitted, specification page 27, paragraph [0056], 
the computer readable medium is not limited to tangible embodiments, 
instead being defined as including both tangible embodiments (e.g., 
"... random access memory, read-only memory (ROM'), CD ROM, floppy disks, 
and magnetic tape ..."paae 27, paragraph [0056]) and intangible 
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embodiments (e.g., "... examples of such media include, but are not limited 
to... random access memory, read-only memory (ROM), CD ROM, floppy 
disks, and magnetic tape ...rtanqible embodiments]"). As such, the claim is 
not limited to statutory subject matter and is therefore non-statutory. 

Claims 12-14, 16-18, 20 and 33 are dependent on claims which have 
been rejected under 35 U.S.C. 101 because the claimed invention is directed 
to non-statutory subject matter and are also rejected. 

Claim Rejections - 35 USC §102 

2. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in 
this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country 
or in public use or on sale in this country, more than one year prior to the date of application 
for patent in the United States. 

3. Claims 1-10, 11-20, 21-30, 31-40, 41-50 are rejected under 35 
U.S.C. 102(b) as being anticipated by US Patent Number 6,115,393 to Engel 
et al CEngel' hereinafter). 

Examiner interprets "state variable information" and "parameters" in 
light of the applicant's specification to describe the condition of the protocol 
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stack at a particular instant in time. This information can be indicated by 
one or more of a protocol identifier, an address, or a port number. The 
protocol identifier indicating what type of protocol was used to establish the 
network connection. Examiner further interprets "protocol engine" to be the 
means that implements a protocol stack. 

Regarding claim 1, Engel discloses a method for characterizing a 
network connection comprising: receiving parameters that specify a 

network connection (Col. 2, lines 21-31; Engel discloses 
monitoring communications which occur in a network of nodes, 
each communication being effected by a transmission of one or 
more packets among two or more communicating nodes which are 
detected passively and in real time, communication information 
associated with multiple protocols is derived from the packet 

contents . ) ; receiving state variable information pertaining to the 
network connection according to the parameters (Col . 2, lines 32- 

41; Engel discloses information about the states of dialogs, 
i.e. state variable information, occurring in the network is 

derived from the packet contents .); sensing when the network 
connection is initiated according to the received state variable 

information (Col. 2, lines 42-45; Engel discloses a current state 
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is maintained for each dialog, and the current state, i.e. state 
variable information, is updated in response to the detected 
contents of transmitted packets . ); and storing the state variable 

information (Col. 2, lines 45-47; Engel discloses for each 
dialog, a history of events is maintained, i.e. stored, 
based on information, i.e. state variable information, 
derived from the contents of packets). 

Regarding claim 2, Engel discloses the method of claim 1 wherein 
receiving state variable information comprises: conveying to a 
protocol engine a parameter including at least one of a protocol 
identifier, a source address, a source port, a destination address and 

a destination port (Col. 8, lines 35-37, 45-55; Engel discloses a 
protocol data unit (PDU) to processes protocol stack, i.e. 
protocol engine, that includes addressing inf ormation . ) ; and 

receiving from the protocol engine a state variable for the network 
connection according to the parameter (col. 8, lines 45-65; Engel 

discloses variable information from the PDU, i.e. protocol 
engine, that corresponds to the port or connection.). 

Regarding claim 3, Engel discloses the method of claim 1 wherein 
sensing when the network connection is initiated comprises 
monitoring the value of a state variable indicative of the connection 
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State Of the connection (Col. 22, lines 58-64; Engel discloses a 
network monitor that monitors the state of the connection based 
on state information received from both ends of the connection.). 

Regarding claim 4, Engel discloses the method of claim 1 wherein 
sensing when the network connection is initiated comprises 
monitoring the value of a TCP/IP state variable called "STATE" (Col . 

22, lines 3-5; Engel discloses the state to which the node is 
changed is specified by the S="STATE" entry.). 

Regarding claim 5, Engel discloses the method of claim 1 further 
comprising: sensing when the network connection terminates 
according to the state variable information (Col. 11, lines 38-52; 

Engel discloses a network monitor with a state machine that 
tracks variable connection states and events, i.e. state 
variable information. The monitor retrieves this information 
whether the connection is active or inactive, i.e. the 

connection terminates. ) ; retrieving stored state variable information 
according to the network connection after the network connection 

terminates (Col. 11, lines 38-52; Engel discloses a network 
monitor with a state machine that tracks variable connection 
states and events, i.e. state variable information. The monitor 
retrieves this information whether the connection is active or 
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inactive, i.e. the connection terminates .); and creating a history 

of the network connection according to the state variable 

information (Col. 22, line 65-Col. 23, line 12; Engel discloses 
there is a history data structure which the state machine uses 
to remember the current state of the connection, the state of 
each of the nodes participating in the connection and a short 
history of state related information.). 

Regarding claim 6, Engel discloses the method of claim 5 wherein 
creating a history of the network connection comprises: developing 
a network connection profile from the state variable information 

(Col. 22, line 65-Col. 23, line 12; Engel discloses there is a 
history data structure which the state machine uses to remember 
the current state of the connection, the state of each of the 
nodes participating in the connection and a short history of 
state related information, i.e. network connection prof ile .); and 

creating a history of the network connection profile (Col. 22, line 

65-Col. 23, line 12; Engel discloses there is a history data 
structure which the state machine uses to remember the current 
state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
related information, i.e. network connection profile. Fig. 8 and 
9 illustrate a network connection profile.). 
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Regarding claim 7, Engel discloses the method of claim 6 wherein 
creating a history of the network connection profile comprises 
detecting an exceptional event (Col. 24, lines 15-25; Engel 

discloses the network monitor keeps useful statistics about the 
connection including any "inconsistencies" or "UNKNOWN" state, 
i.e. exceptional events, which have occurred over the 
connection) . 

Regarding claim 8, Engel discloses the method of claim 7 further 
comprising analyzing the exceptional event (Col . 24, lines 15-25; 
Engel discloses the network monitor keeps useful statistics 
about the connection including any "inconsistencies" or 
"UNKNOWN" state, i.e. exceptional events, which have occurred 
over the connection. Col. 24, lines 21-29; Engel discloses how 
the network monitor analyzes "inconsistencies" and "UNKNOWN" 
states . ) . 

Regarding claim 9, Engel discloses the method of claim 1 further 
comprising: retrieving the state variable information while the 
network connection continues (Col . 11, lines 38-52; Engel 

discloses a network monitor with a state machine that tracks 
variable connection states and events, i.e. state variable 
information. The monitor retrieves this information whether the 
connection is active or inactive, i.e. while the network 
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continues . ) ; and making the state variable information available on 

a periodic basis (Col. 12, lines 57-62; Engel discloses a network 
monitor with an event manager that calculates time averages and 
performs periodic updates of the monitor's variables.). 

Regarding claim 10, Engel discloses the method of claim 9 further 
wherein making state variable information available comprises: 
creating a dynamic profile of the network connection according to 
the state variable information (Col. 13, lines 30-32; Engel 

discloses a network monitor with an address tracking module that 
keeps track of the node name to node address bindings on 
networks which implement dynamic node addressing protocols, i.e. 
creates a dynamic profile of the network connection according to 
state variable information . ); and making the dynamic profile 
available on a periodic basis (Col. 12, lines 57-62; Engel 

discloses a network monitor with an event manager that 
calculates time averages and performs periodic updates of the 
monitor's variables.). 

Regarding claim 11, Engel discloses a network connection analysis 
unit capable of characterizing a network connection, said network 
connection analysis unit comprising: supervisor comprising: 
command register capable of receiving parameters that specify a 
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network connection (Col. 2, lines 21-31; Engel discloses 
monitoring communications which occur in a network of nodes, 
each communication being effected by a transmission of one or 
more packets among two or more communicating nodes which are 
detected passively and in real time, communication information 
associated with multiple protocols is derived from the packet 
contents. Engel uses a network monitor, i.e. network connection 

analysis unit, to do this .), and source address register capable of 
receiving an address referencing the location of state variables in a 

State memory (Col. 6, line 53-59/ Engel discloses a Network 
Monitor with a memory and a processor. Col. 2, lines 21-31; 
Engel discloses monitoring communications which occur in a 
network of nodes, each communication being effected by a 
transmission of one or more packets among two or more 
communicating nodes which are detected passively and in real 
time, communication information associated with multiple 
protocols is derived from the packet contents .); Supervisory 

controller capable of: directing a state variable request to a protocol 
engine according to the parameters (Col . 2, lines 32-41; Engel 

discloses information about the states of dialogs, i.e. state 
variable information, occurring in the network is derived from 

the packet contents . ) ; sensing when the network connection is 
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initiated by monitoring a location in the state memory as referenced 
by the contents of the source address register (col . 2, lines 42-45; 

Engel discloses a current state is maintained for each dialog, 
and the current state, i.e. state variable information, is 
updated in response to the detected contents of transmitted 

packets . ) , and first computer readable medium controller capable of 
directing a plurality of state variables from the state memory to a 
computer readable medium when the network connection is initiated 

(Col. 2, lines 45-47; Engel discloses for each dialog, a 
history of events is maintained, i.e. stored or 
directed to a computer readable storage medium, based 
on information, i.e. state variable information, 
derived from the contents of packets). 

Regarding claim 12, Engel discloses the network connection 
analysis unit of claim 11 wherein the command register generates 
parameters including at least one of a protocol identifier, a source 
address, a source port, a destination address and a destination port 

(Col. 8, lines 35-37, 45-55; Engel discloses a protocol data 
unit (PDU) to processes protocol stack, i.e. protocol engine, 
that includes addressing information.) and wherein the controller 

is further capable of loading into the source address register a 
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memory reference received from a protocol engine (Col . 8, lines 

45-65; Engel discloses variable information from the PDU, i.e. 
protocol engine, that corresponds to the port or connection.). 

Regarding claim 13, Engel discloses the network connection 
analysis unit of claim 11 wherein the state memory referenced by 
the source address register contains an indictor of activity of the 

network connection (Col. 22, lines 58-64; Engel discloses a 
network monitor that monitors the state of the connection based 
on state information received from both ends of the connection.). 

Regarding claim 14, Engel discloses the network connection 
analysis unit of claim 11 wherein the state memory referenced by 
the source address register contains a TCP/IP state variable called 

"STATE" (Col. 22, lines 3-5; Engel discloses the state to which 
the node is changed is specified by the S="STATE" entry.). 

Regarding claim 15, Engel discloses the network connection 
analysis unit of claim 11 further comprising an off-line connection 
analyzer comprising: off-line command register capable of receiving 
an off-line analysis request that includes a connection specifier (Col. 

11, lines 38-52; Engel discloses a network monitor with a state 
machine that tracks variable connection states and events, i.e. 
state variable information or connection specifiers. The 
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monitor retrieves this information whether the connection is 
active or inactive, i.e. the connection terminates . ); off-line 

computer readable medium controller capable of retrieving state 
variables from a computer readable medium according to the 

connection specifier (Col. 11, lines 38-52; Engel discloses a 
network monitor with a state machine that tracks variable 
connection states and events, i.e. state variable information or 
connection specifier. The monitor retrieves this information 
whether the connection is active or inactive, i.e. the 

connection terminates . ) ; format table capable of converting the 
state variables into a print stream (Col. 22, line 65-coi. 23, line 

12; Engel discloses there is a history data structure which the 
state machine uses to remember the current state of the 
connection, the state of each of the nodes participating in the 
connection and a short history of state related information. 
Col. 28, lines 45-60; Engel discloses a summary tool that 
displays network operation status with statistical information 
at each node. This data can be printed out .); off-line analysis 

controller capable of causing the second computer readable medium 
controller to retrieve state variables and further capable of directing 
the retrieved state variables to the format table (Col . 22, line 65- 

Col. 23, line 12; Engel discloses there is a history data 
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structure which the state machine uses to remember the current 
state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
related information.). 

Regarding claim 16, Engel discloses the network connection 
analysis unit of claim 15 wherein format table includes a profile 
description that correlates one or more state variables to a 

connection profile (Col. 22, line 65-Col. 23, line 12; Engel 
discloses there is a history data structure which the state 
machine uses to remember the current state of the connection, 
the state of each of the nodes participating in the connection 
and a short history of state related information, i.e. network 
connection profile.). 

Regarding claim 17, Engel discloses the network connection 
analysis unit of claim 16 wherein the off-line connection analyzer 
further comprises an exceptional event detector capable of detecting 

an exceptional event (Col. 24, lines 15-25; Engel discloses the 
network monitor keeps useful statistics about the connection 
including any "inconsistencies" or "UNKNOWN" state, i.e. 
exceptional events, which have occurred over the connection). 

Regarding claim 18, Engel discloses the network connection 
analysis unit of claim 17 wherein the exceptional event detector is 
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capable of analyzing the exceptional event (Col . 24, lines 15-25; 

Engel discloses the network monitor keeps useful statistics 
about the connection including any "inconsistencies" or 
"UNKNOWN" state, i.e. exceptional events, which have occurred 
over the connection. Col. 24, lines 21-29; Engel discloses how 
the network monitor analyzes "inconsistencies" and "UNKNOWN" 
states . ) . 

Regarding claim 19, Engel discloses the network connection 
analysis unit of claim 11 further comprising a real-time connection 
analyzer comprising: real-time command register capable of 
receiving an real-line analysis request that includes a connection 

Specifier (Col. 11, lines 38-52; Engel discloses a network monitor 
with a state machine that tracks variable connection states and 
events, i.e. state variable information. The monitor retrieves 
this information whether the connection is active or inactive, 

i.e. while the network continues .); real-time computer readable 
medium controller capable of retrieving state variables from a 
computer readable medium according to the connection specifier 

(Col. 11, lines 38-52; Engel discloses a network monitor with a 
state machine that tracks variable connection states and events, 
i.e. state variable information. The monitor retrieves this 
information whether the connection is active or inactive, i.e. 
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while the network continues . ) ; and display subsystem capable of 
generating a display signal according to the retrieved state variables 

(Col. 28, lines 45-60; Engel discloses a summary tool that 
displays network operation status with statistical information 
at each node . ) . 

Regarding claim 20, Engel discloses the network connection 
analysis unit of claim 19 wherein the display subsystem comprises: 
profile generator capable of creating a profile of a network 

connection (Col. 28, lines 45-60; Engel discloses a summary tool 
that displays network operation status with statistical 
information at each node, i.e. network connection.). 

Regarding claim 21, Engel discloses a network connection analysis 
system comprising: memory capable of storing instructions (Col . 6, 

line 53-59; Engel discloses a Network Monitor with a memory and 

a processor. ) ; processor capable of executing instructions stored in 

the memory (Col. 6, lines 53-59; Engel discloses a Network 

Monitor with a processor .); and network connection 
characterization instruction sequence that, when executed by the 
processor, minimally causes the processor to: receive parameters 
that specify a network connection (Col. 2, lines 21-31; Engel 

discloses monitoring communications which occur in a network of 
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nodes, each communication being effected by a transmission of 
one or more packets among two or more communicating nodes which 
are detected passively and in real time, communication 
information associated with multiple protocols is derived from 

the packet contents. ) ; receive state variable information pertaining 
to the network connection according to the parameters (Col . 2, 

lines 32-41; Engel discloses information about the states of 
dialogs, i.e. state variable information, occurring in the 
network is derived from the packet contents .); sense when the 

network connection is initiated according to the received state 

variable information (Col. 2, lines 42-45/ Engel discloses a 
current state is maintained for each dialog, and the current 
state, i.e. state variable information, is updated in response 
to the detected contents of transmitted packets .); and Store the 
State variable information (Col. 2, lines 45-47; Engel discloses 
for each dialog, a history of events is maintained, 
i.e. stored, based on information, i.e. state variable 
information, derived from the contents of packets). 

Regarding claim 22, Engel discloses the network connection 
analysis system of claim 21 wherein the network connection 
characterization instruction sequence includes a state variable 
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information receiver instruction sequence that, when executed by 
the processor, causes the processor to receive state variable 
information by minimally causing the processor to: convey to a 
protocol engine a parameter including at least one of a protocol 
identifier, a source address, a source port, a destination address and 

a destination port (Col. 8, lines 35-37, 45-55; Engel discloses a 
protocol data unit (PDU) to processes protocol stack, i.e. 
protocol engine, that includes addressing inf ormation . ) ; and 

receive from the protocol engine state variables for the network 
connection according to the parameter (Col . 8, lines 45-65; Engel 

discloses variable information from the PDU, i.e. protocol 
engine, that corresponds to the port or connection.). 

Regarding claim 23, Engel discloses the network connection 
analysis system of claim 21 wherein the network connection 
characterization instruction sequence causes the processor to sense 
when the network connection has been initiated by minimally 
causing the processor to monitor the value of a state variable that is 
indicative of the connection state of the connection (col . 22, lines 

58-64; Engel discloses a network monitor that monitors the state 
of the connection based on state information received from both 
ends of the connection.). 
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Regarding claim 24, Engel discloses the network connection 
analysis system of claim 21 wherein the network connection 
characterization instruction sequence causes the processor to sense 
when the network connection has been initiated by minimally 
causing the processor to monitor the value of a TCP/IP state 
variable called "STATE" (Col. 22, lines 3-5; Engel discloses the 
state to which the node is changed is specified by the S="STATE" 
entry. ) . 

Regarding claim 25, Engel discloses the network connection 
analysis system of claim 21 further comprising an off-line connection 
analysis instruction sequence that, when executed by the processor, 
minimally causes the processor to: sense when the network 
connection terminates according to the state variable information 

(Col. 11, lines 38-52; Engel discloses a network monitor with a 
state machine that tracks variable connection states and events, 
i.e. state variable information. The monitor retrieves this 
information whether the connection is active or inactive, i.e. 

the connection terminates.); retrieve stored state variable 
information after the network connection terminates (col. n, 

lines 38-52; Engel discloses a network monitor with a state 
machine that tracks variable connection states and events, i.e. 
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state variable information. The monitor retrieves this 
information whether the connection is active or inactive, i.e. 

the connection terminates . ) ; and create a history of the network 
connection according to the state variable information (Col. 22, 

line 65-Col. 23, line 12; Engel discloses there is a history 
data structure which the state machine uses to remember the 
current state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
related information.). 

Regarding claim 26, Engel discloses the network connection 
analysis system of claim 25 wherein the off-line connection analysis 
instruction sequence comprises a network connection profile 
creation instruction sequence that, when executed by the processor, 
causes the processor to create a history by minimally causing the 
processor to: develop a network connection profile from the state 

variable information (Col. 22, line 65-Col. 23, line 12; Engel 
discloses there is a history data structure which the state 
machine uses to remember the current state of the connection, 
the state of each of the nodes participating in the connection 
and a short history of state related information, i.e. network 

connection profile . ) ; and create a history of the network 

connection profile (Col. 22, line 65-Col. 23, line 12; Engel 
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discloses there is a history data structure which the state 
machine uses to remember the current state of the connection, 
the state of each of the nodes participating in the connection 
and a short history of state related information, i.e. network 
connection profile. Fig. 8 and 9 illustrate a network connection 
profile . ) . 

Regarding claim 27, Engel discloses the network connection 
analysis system of claim 26 wherein the network connection profile 
creation instruction sequence comprises an exceptional event 
detection instruction sequence that, when executed by the 
processor, minimally causes the processor to detect an exceptional 

event (Col. 24, lines 15-25; Engel discloses the network monitor 
keeps useful statistics about the connection including any 
"inconsistencies" or "UNKNOWN" state, i.e. exceptional events, 
which have occurred over the connection) . 

Regarding claim 28, Engel discloses the network connection 
analysis system of claim 27 wherein the network connection profile 
creation instruction sequence further comprises an exceptional 
event analysis instruction sequence that, when executed by the 
processor, minimally causes the processor to analyze the 

exceptional event (Col. 24, lines 15-25; Engel discloses the 
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network monitor keeps useful statistics about the connection 
including any "inconsistencies" or "UNKNOWN" state, i.e. 
exceptional events, which have occurred over the connection. 
Col. 24, lines 21-29; Engel discloses how the network monitor 
analyzes "inconsistencies" and "UNKNOWN" states.). 

Regarding claim 29, Engel discloses the network connection 
analysis system of claim 21 further comprising: display driver 
capable of generating a display signal (Col. 28, lines 45-60; Engel 

discloses a summary tool that displays network operation status 

with statistical information. ) ; and real-time connection analysis 
instruction sequence that, when executed by the processor, further 
minimally causes the processor to: retrieve the state variable 
information while the network connection continues (Col. n, lines 

38-52; Engel discloses a network monitor with a state machine 
that tracks variable connection states and events, i.e. state 
variable information. The monitor retrieves this information 
whether the connection is active or inactive, i.e. while the 

network continues . ) ; and direct the state information to the display 

driver (Col. 28, lines 45-60; Engel discloses a summary tool that 
displays network operation status with statistical information 
at each node . ) . 



Art Unit: 4121 

Regarding claim 30, Engel discloses the network connection 
analysis system of claim 29 wherein the real-time connection 
analysis instruction sequence comprises a dynamic profile 
generation instruction sequence that, when executed by the 
processor, minimally causes the processor to: create a dynamic 
profile of the network connection according to the state variable 

information (Col. 13, lines 30-32; Engel discloses a network 
monitor with an address tracking module that keeps track of the 
node name to node address bindings on networks which implement 
dynamic node addressing protocols, i.e. creates a dynamic 
profile of the network connection according to state variable 

information. ) ; and direct the dynamic profile to the display driver 

(Col. 28, lines 45-60; Engel discloses a summary tool that 
displays network operation status with statistical information 
at each node . ) . 

Regarding claim 31, Engel discloses a computer-readable medium 
having computer-executable functions for characterizing a network 
connection comprising: network connection characterization 
instruction sequence that, when executed by a processor, minimally 

causes the processor to (Col. 6, line 53-59; Engel discloses a 

Network Monitor with a memory and a processor.): receive 
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parameters that specify a network connection (Col. 2, lines 21-31; 

Engel discloses monitoring communications which occur in a 
network of nodes, each communication being effected by a 
transmission of one or more packets among two or more 
communicating nodes which are detected passively and in real 
time, communication information associated with multiple 
protocols is derived from the packet contents .)} receive State 

variable information pertaining to the network connection according 

to the parameters (Col. 2, lines 32-41; Engel discloses 
information about the states of dialogs, i.e. state variable 
information, occurring in the network is derived from the packet 

contents . ) ; sense when the network connection is initiated 
according to the received state variable information (Col. 2, lines 

42-45; Engel discloses a current state is maintained for each 
dialog, and the current state, i.e. state variable information, 
is updated in response to the detected contents of transmitted 

packets .); and store the state variable information (Col . 2, lines 
45-47; Engel discloses for each dialog, a history of events 
is maintained, i.e. stored, based on information, i.e. 
state variable information, derived from the contents 
of packets). 
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Regarding claim 32, Engel discloses the computer-readable 
medium of claim 31 wherein the network connection 
characterization instruction sequence includes a state variable 
information receiver instruction sequence that, when executed by a 
processor, causes the processor to receive state variable information 
by minimally causing the processor to: convey to a protocol engine a 
parameter including at least one of a protocol identifier, a source 
address, a source port, a destination address and a destination port 

(Col. 8, lines 35-37, 45-55; Engel discloses a protocol data 
unit (PDU) to processes protocol stack, i.e. protocol engine, 
that includes addressing information .); and receive from the 

protocol engine state variables for the network connection according 

to the parameter (Col. 8, lines 45-65; Engel discloses variable 
information from the PDU, i.e. protocol engine, that corresponds 
to the port or connection.). 

Regarding claim 33, Engel discloses the network connection 
analysis system of claim 31 wherein the network connection 
characterization instruction sequence causes the processor to sense 
when the network connection has been initiated by minimally 
causing the processor to monitor the value of a state variable that is 
indicative of the connection state of the connection (col . 22, lines 
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58-64; Engel discloses a network monitor that monitors the state 
of the connection based on state information received from both 
ends of the connection.). 

Regarding claim 34, Engel discloses the network connection 
analysis system of claim 31 wherein the network connection 
characterization instruction sequence causes the processor to sense 
when the network connection has been initiated by minimally 
causing the processor to monitor the value of a TCP/IP state 
variable called "STATE" (Col. 22, lines 3-5; Engel discloses the 
state to which the node is changed is specified by the S="STATE" 
entry. ) . 

Regarding claim 35, Engel discloses the computer-readable 
medium of claim 31 further comprising an off-line connection 
analysis instruction sequence that, when executed by a processor, 
minimally causes the processor to: sense when the network 
connection terminates according to the state variable information 

(Col. 11, lines 38-52; Engel discloses a network monitor with a 
state machine that tracks variable connection states and events, 
i.e. state variable information. The monitor retrieves this 
information whether the connection is active or inactive, i.e. 

the connection terminates . ) ; retrieve stored state variable 
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information after the network connection terminates (Col. 11, 

lines 38-52; Engel discloses a network monitor with a state 
machine that tracks variable connection states and events, i.e. 
state variable information. The monitor retrieves this 
information whether the connection is active or inactive, i.e. 

the connection terminates . ) ; and create a history of the network 
connection according to the state variable information (Col. 22, 

line 65-Col. 23, line 12; Engel discloses there is a history 
data structure which the state machine uses to remember the 
current state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
related information.). 

Regarding claim 36, Engel discloses the computer-readable 
medium of claim 35 wherein the off-line connection analysis 
instruction sequence comprises a network connection profile 
creation instruction sequence that, when executed by a processor, 
causes the processor to create a history by minimally causing the 
processor to: develop a network connection profile from the state 

variable information (Col. 22, line 65-Col. 23, line 12; Engel 
discloses there is a history data structure which the state 
machine uses to remember the current state of the connection, 
the state of each of the nodes participating in the connection 
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and a short history of state related information, i.e. network 

connection profile . ) ; and create a history of the network 

connection profile (Col. 22, line 65-Col. 23, line 12; Engel 
discloses there is a history data structure which the state 
machine uses to remember the current state of the connection, 
the state of each of the nodes participating in the connection 
and a short history of state related information, i.e. network 
connection profile. Fig. 8 and 9 illustrate a network connection 
profile . ) . 

Regarding claim 37, Engel discloses the computer-readable 
medium of claim 36 wherein the network connection history profile 
instruction sequence comprises an exceptional event detection 
instruction sequence that, when executed by a processor, minimally 
causes the processor to detect an exceptional event (Col. 24, lines 

15-25; Engel discloses the network monitor keeps useful 
statistics about the connection including any "inconsistencies" 
or "UNKNOWN" state, i.e. exceptional events, which have occurred 
over the connection) . 

Regarding claim 38, Engel discloses the computer-readable 
medium of claim 37 wherein the network connection profile creation 
instruction sequence further comprises an exceptional event 
analysis instruction sequence that, when executed by a processor, 
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minimally causes the processor to analyze the exceptional event 

(Col. 24, lines 15-25; Engel discloses the network monitor keeps 
useful statistics about the connection including any 
"inconsistencies" or "UNKNOWN" state, i.e. exceptional events, 
which have occurred over the connection. Col. 24, lines 21-29; 
Engel discloses how the network monitor analyzes 
"inconsistencies" and "UNKNOWN" states.). 

Regarding claim 39, Engel discloses the computer-readable 
medium of claim 31 further comprising a real-time connection 
analysis instruction sequence that, when executed by a processor, 
further minimally causes the processor to: retrieve the state variable 
information while the network connection continues (Col. n, lines 

38-52; Engel discloses a network monitor with a state machine 
that tracks variable connection states and events, i.e. state 
variable information. The monitor retrieves this information 
whether the connection is active or inactive, i.e. while the 

network continues . ) ; and direct the state information to a display 

driver (Col. 28, lines 45-60; Engel discloses a summary tool that 
displays network operation status with statistical information 
at each node . ) . 

Regarding claim 40, Engel discloses the computer-readable 
medium of claim 39 wherein the real-time connection analysis 
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instruction sequence comprises a dynamic profile generation 
instruction sequence that, when executed by a processor, minimally 
causes the processor to: create a dynamic profile of the network 
connection according to the state variable information (Col . 13, 

lines 30-32; Engel discloses a network monitor with an address 
tracking module that keeps track of the node name to node 
address bindings on networks which implement dynamic node 
addressing protocols, i.e. creates a dynamic profile of the 
network connection according to state variable inf ormation . ) ; and 

direct the dynamic profile to the display driver (Col . 28, lines 45- 

60; Engel discloses a summary tool that displays network 
operation status with statistical information at each node.). 

Regarding claim 41, Engel discloses a network connection analysis 
apparatus comprising: means for receiving state variable 
information pertaining to the network connection according to a set 
of received network parameters (Col. 6, line 53-59; Engel 

discloses a Network Monitor apparatus/means to monitor network 
connections. Col. 2, lines 32-41; Engel discloses information 
about the states of dialogs, i.e. state variable information, 
occurring in the network is derived from the packet contents.); 

means for sensing initiation of the network connection according to 
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the received state variable information (Col. 2, lines 42-45; Engei 

discloses a current state is maintained for each dialog, and the 
current state, i.e. state variable information, is updated in 
response to the detected contents of transmitted packets .); and 
means for storing the state variable information (Col. 2, lines 45- 
47; Engel discloses for each dialog, a history of events 
is maintained, i.e. stored, based on information, i.e. 
state variable information, derived from the contents 
of packets). 

Regarding claim 42, Engel discloses the network connection 
analysis apparatus of claim 41 wherein the state variable 
information receiving means comprises: means for conveying to a 
protocol engine a parameter including at least one of a protocol 
identifier, a source address, a source port, a destination address and 

a destination port (Col. 8, lines 35-37, 45-55; Engel discloses a 
protocol data unit (PDU) to processes protocol stack, i.e. 
protocol engine, that includes addressing inf ormation . ) ; and 

means for receiving from the protocol engine a state variable for the 
network connection according to the parameter (col . 8, lines 45- 

65; Engel discloses variable information from the PDU, i.e. 
protocol engine, that corresponds to the port or connection.). 
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Regarding claim 43, Engel discloses the network connection 
analysis apparatus of claim 41 wherein the means for sensing 
initiation of the network connection comprise a means for 
monitoring the value of a state variable indicative of the connection 
state of a network connection (Col. 22, lines 58-64; Engel 

discloses a network monitor that monitors the state of the 
connection based on state information received from both ends of 
the connection . ) . 

Regarding claim 44, Engel discloses the network connection 
analysis apparatus of claim 41 wherein the means for sensing 
initiation of the network connection comprise a means for 
monitoring the value of a TCP/IP state variable called "STATE" (Col . 
22, lines 3-5; Engel discloses the state to which the node is 
changed is specified by the S="STATE" entry.). 

Regarding claim 45, Engel discloses the network connection 
analysis apparatus of claim 41 further comprising: means for 
sensing when the network connection terminates according to the 

State variable information (Col. 11, lines 38-52; Engel discloses a 
network monitor with a state machine that tracks variable 
connection states and events, i.e. state variable information. 
The monitor retrieves this information whether the connection is 
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active or inactive, i.e. the connection terminates .); means for 

retrieving stored state variable information according to the network 
connection after the network connection terminates (Col. 11, lines 

38-52; Engel discloses a network monitor with a state machine 
that tracks variable connection states and events, i.e. state 
variable information. The monitor retrieves this information 
whether the connection is active or inactive, i.e. the 

connection terminates . ) ; and means for creating a history of the 
network connection according to the state variable information (Col. 
22, line 65-Col. 23, line 12; Engel discloses there is a history 
data structure which the state machine uses to remember the 
current state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
related information.). 

Regarding claim 46, Engel discloses the network connection 
analysis apparatus of claim 45 wherein means for creating a history 
of the network connection comprises: means for developing a 
network connection profile from the state variable information (Col . 

22, line 65-Col. 23, line 12; Engel discloses there is a history 
data structure which the state machine uses to remember the 
current state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
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related information, i.e. network connection prof ile .); and 

means for creating a history of the network connection profile (Col . 

22, line 65-Col. 23, line 12; Engel discloses there is a history 
data structure which the state machine uses to remember the 
current state of the connection, the state of each of the nodes 
participating in the connection and a short history of state 
related information, i.e. network connection profile. Fig. 8 and 
9 illustrate a network connection profile.). 

Regarding claim 47, Engel discloses the network connection 
analysis apparatus of claim 46 wherein means for creating a history 
of the network connection profile comprises means for detecting an 

exceptional event (Col. 24, lines 15-25; Engel discloses the 
network monitor keeps useful statistics about the connection 
including any "inconsistencies" or "UNKNOWN" state, i.e. 
exceptional events, which have occurred over the connection). 

Regarding claim 48, Engel discloses the network connection 
analysis apparatus of claim 47 further comprising means for 
analyzing the exceptional event (Col . 24, lines 15-25; Engel 

discloses the network monitor keeps useful statistics about the 
connection including any "inconsistencies" or "UNKNOWN" state, 
i.e. exceptional events, which have occurred over the 
connection. Col. 24, lines 21-29; Engel discloses how the 



Art Unit: 4121 

network monitor analyzes "inconsistencies" and "UNKNOWN" 
states . ) . 

Regarding claim 49, Engel discloses the network connection 
analysis apparatus of claim 41 further comprising: means for 
retrieving the state variable information while the connection 

continues (Col. 11, lines 38-52; Engel discloses a network 
monitor with a state machine that tracks variable connection 
states and events, i.e. state variable information. The monitor 
retrieves this information whether the connection is active or 
inactive, i.e. while the network continues .); and means for 

making the state variable information available on a periodic basis 

(Col. 12, lines 57-62; Engel discloses a network monitor with an 
event manager that calculates time averages and performs 
periodic updates of the monitor's variables.). 

Regarding claim 50, Engel discloses the network connection 
analysis apparatus of claim 49 wherein means for making the state 
variable information available comprises: means for creating a 
dynamic profile of the network connection according to the state 

variable information (Col. 13, lines 30-32; Engel discloses a 
network monitor with an address tracking module that keeps track 
of the node name to node address bindings on networks which 
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implement dynamic node addressing protocols, i.e. creates a 
dynamic profile of the network connection according to state 

variable information. ) ; and means for making the dynamic profile 
available on a periodic basis (Col. 12, lines 57-62; Engei 

discloses a network monitor with an event manager that 
calculates time averages and performs periodic updates of the 
monitor's variables.). 

Conclusion 

4. The prior art made of record and not relied upon is considered 
pertinent to applicant's disclosure: 

• US Patent Number 5,566,170 to Bakke et al titled "Method and 
Apparatus for Accelerated Packet Forwarding." 

• US Patent Publication Number 2003/0091165 to Bearden et al titled 
"Report Generation and Visualization Systems and Methods and 
their use in Testing Frameworks for Determining Suitability of a 
Network for Target Applications." 

• US Patent Number 7,089,326 to Boucher et al titled "Fast-Path 
Processing for Receiving Data on TCP Connection Offload Devices." 

• US Patent Number 6,975,330 to Charlton et al titled "Graphic 
Display of Network Performance Information." 



Art Unit: 4121 

• US Patent Number 5,671,355 to Collins titled "Reconfigurable 
Network Interface Apparatus and Method." 

• US Patent Number 5,937,169 to Connery et al titled "Offload of TCP 
Segmentation to a Smart Adapter." 

• US Patent Publication Number 2004/0015579 to Cooper et al titled 
"Method and Apparatus for Enterprise Management." 

• US Patent Number 5,751,965 to Mayo et al titled "Network 
Connection Status Monitor and Display." 

• US Patent Number 5,598,410 to Stone titled "Method and 
Apparatus for Accelerated Packet Processing." 

• US Patent Number 5,511,169 to Suda titled "Data Transmission 
Apparatus and a Communication Path Management Method 
Therefor." 

• US Patent Publication Number 2002/0157018 to Syvanne titled 
"Method of Managing a Network Device, a Management System, 
and a Network Device." 

• US Patent Number 5,303,344 to Yokoyama et al titled "Protocol 
Processing Apparatus for use in Interfacing Network Connected 
Computer Systems Utilizing Separate Paths for Control Information 
and Data Transfer." 
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